groups:
- name: EKS-central-Cilium-Alerts
  rules:
  - alert: central-MapOps-Crossed-Threshold
    expr: topk(5, avg(rate(cilium_bpf_map_ops_total{k8s_app="cilium", map_name=~"snat_v4_external", operation=~"delete", cluster=~".*central.*"}[5m])) by (kubernetes_pod_name, instance, map_name, operation, cluster)) <= 40
    for: 1m
    labels:
      severity: critical
      bu: infra
      team: devops
      service: eks-cilium
      env: prd
      priority: p0
    annotations:
      summary: "central Cilium Map Ops has crossed 40 Ops per Second for Map Name - snat_v4_external, operation - delete, Pod - {{ $labels.kubernetes_pod_name }}, Instance - {{ $labels.instance }}, cluster - {{ $labels.cluster }} and the value is {{ $value }}"
      description: "central Cilium Map Ops has crossed 40 Ops per Second for Map Name - snat_v4_external, operation - delete, Pod - {{ $labels.kubernetes_pod_name }}, Instance - {{ $labels.instance }}, cluster - {{ $labels.cluster }} and the value is {{ $value }}\n  Labels - {{ $labels }}"

  - alert: SubnetOutofIpsForCentralCluster
    expr: sum(cilium_operator_ipam_available_ips_per_subnet{cluster=~".*central.*",subnet_id!~"(subnet-068af921836ca6723|subnet-025917a40be07542c)"}) by (cluster) < 700
    for: 1m
    labels:
      severity: critical
      bu: infra
      team: devops
      service: eks-cilium
      env: prd
      priority: p0
    annotations:
      summary: "Cluster {{ $labels.cluster }} has ip address less than 700. Please check"
      description: "Cluster {{ $labels.cluster }} is left with ip address of VALUE = {{ $value }} which is less than 700.\n  LABELS: {{ $labels }}"